Mapping the Minefield of Open Source Software Risks - DevOps 2024

Explore the complexities of open source software risks in this 22-minute conference talk from Conf42 DevOps 2024. Delve into topics such as software dependencies, open source vulnerabilities, and prioritization strategies. Learn about tools like Semgrep Supply Chain and Software Composition Analysis for managing risks. Discover reachability analysis, remediation techniques, and the importance of semantic versioning. Gain practical insights on handling manifest files, dependency versions, and transitive vulnerabilities. Walk away with key takeaways and valuable resources to enhance your DevOps practices and mitigate open source software risks effectively.

intro
preamble
about kyle
agenda
software dependencies
open source software oss
oss vulnerabilities
an uncomfortable prioritization exercise
semgrep supply chain ssc
software composition analysis sca
one of a few ways: reachability
now what? remediation
easy wins with semantic versioning semver
manifest file dependency versions
example
transitive vulnerabilities
key takeaways
resources